- Error code
- ORA-65096
- Product
- Oracle Database
- Versions
- Oracle Database 19c, 21c, 23ai and 26ai, multitenant container databases (wording differs: see below)
- Category
- Logins, Accounts & Privileges
- Last reviewed
- 24 October 2026
On this page
What it means
ORA-65096 means you ran CREATE USER or CREATE ROLE while connected to the root of a container database, so Oracle tried to create a common user or role, and the name lacks the required C## prefix.
A multitenant container database (CDB) has a root, CDB$ROOT, and one or more pluggable databases (PDBs). A user created in the root is a common user, with the same identity in the root and in every PDB; a user created in a PDB is a local user that exists only there. The CREATE USER reference says CONTAINER = ALL is the default in the root, so a plain CREATE USER there always means a common user. The COMMON_USER_PREFIX parameter, C## by default in the root, requires common user, role and profile names to start with that prefix, and the name you gave does not.
In almost every case you did not want a common user at all: you wanted an ordinary application user, and you are simply connected to the wrong container. This is the classic first error on Oracle Database Free, where sqlplus / as sysdba and the service FREE connect to the root, while application users belong in the PDB FREEPDB1. Connect to the PDB and the same CREATE USER creates a local user, with no prefix.
Current releases print the prefix in the message. 19c and 21c say "invalid common user or role name", and their reference adds that common names must also consist only of ASCII characters.
Common causes
- Connected to CDB$ROOT (for example with sqlplus / as sysdba, or the root service such as FREE) when creating an application user.
- Following a tutorial written for a non-CDB database, where CREATE USER app_user works as is.
- Intending a common user (for administration across PDBs) but leaving out the C## prefix.
- A common user or role name that contains non-ASCII characters (the 19c reference lists this as well).
Diagnose it
Read-only These queries only read the data dictionary (USER_, ALL_ and DBA_ views) and dynamic performance views (V$). They do not change data, privileges or settings, so they are safe to run first. DBA_ and V$ views need the matching privileges.
Which container am I in?
In SQL*Plus or SQLcl, SHOW CON_NAME gives the same answer.
SELECT SYS_CONTEXT('USERENV', 'CON_NAME') AS container,
SYS_CONTEXT('USERENV', 'CON_ID') AS con_id
FROM dual;CDB$ROOT (CON_ID 1) means you are in the root, where CREATE USER creates a common user. A PDB name, such as FREEPDB1, means a local user would be created.
Which PDBs are there, and are they open?
SELECT con_id, name, open_mode
FROM v$pdbs
ORDER BY con_id;The PDBs you can connect to. OPEN_MODE must be READ WRITE to create users there. PDB$SEED is the template and is not for users.
What prefix does this CDB require?
SELECT name, value
FROM v$parameter
WHERE name = 'common_user_prefix';The prefix for common names. Oracle's reference notes that the database enforces C## in the root even though V$PARAMETER shows NONE as the default value.
How to fix it
Each fix is labelled with what it changes. Try read-only checks and the least invasive fix first, and test changes outside production.
Connect to the PDB and create a local user there
Client or network sideConnect through the PDB's service, then run CREATE USER as before. On Oracle Database Free the PDB service is FREEPDB1.
sqlplus sys@//localhost:1521/FREEPDB1 as sysdbaOr switch container in the current session
Changes configurationA common user with the SET CONTAINER privilege can move the session into the PDB with ALTER SESSION; it affects only this session.
ALTER SESSION SET CONTAINER = FREEPDB1;Create the application user with least privilege
Changes permissionsIn the PDB, create the user without a prefix and grant only what the application needs, with a quota on its tablespace instead of UNLIMITED TABLESPACE or broad roles.
CREATE USER app_user IDENTIFIED BY "Str0ng#Passw0rd"
DEFAULT TABLESPACE users
QUOTA 500M ON users;
GRANT CREATE SESSION, CREATE TABLE, CREATE VIEW, CREATE SEQUENCE TO app_user;If you really need a common user, use the prefix
Changes permissionsCommon users are for administering the CDB and many PDBs, not for application schemas. Create them in the root with the prefix, and grant CREATE SESSION only in the containers where they need it. Do not use the undocumented _ORACLE_SCRIPT parameter or set COMMON_USER_PREFIX to an empty string to avoid the prefix: Oracle's reference warns that an empty prefix can cause name conflicts between common and local users.
Caution: A common user exists in every current and future PDB. Grant it only the privileges it needs, and only where it needs them.
CREATE USER c##ops_admin IDENTIFIED BY "Str0ng#Passw0rd" CONTAINER = ALL;
GRANT CREATE SESSION TO c##ops_admin CONTAINER = ALL;Examples
Creating an application user in the root of Oracle Database Free
Not reproduced here: no Oracle Database is installed for this site. The message format is from Oracle's error reference for current releases, with the default prefix C## filled in; Oracle Database 19c and 21c print "invalid common user or role name". The user name and password are illustrative.
-- sqlplus / as sysdba (connects to CDB$ROOT)
CREATE USER app_user IDENTIFIED BY "Str0ng#Passw0rd";ORA-65096: common user or role name must start with prefix C##
Creating a role in the root without the prefix
Not reproduced here: no Oracle Database is installed for this site. The message format is from Oracle's error reference, which covers roles as well as users; the role name is illustrative. Create the role in the PDB instead, or name it C##REPORT_READER if it must be common.
-- connected to CDB$ROOT
CREATE ROLE report_reader;ORA-65096: common user or role name must start with prefix C##
How to prevent it
Always check the container (SHOW CON_NAME) before creating users or roles, and save connections in your tools with the PDB service rather than the root. Keep application schemas as local users in their PDB.
Use common users only for CDB-wide administration, always with the C## prefix, and leave COMMON_USER_PREFIX at its default.
Common questions
How do I fix ORA-65096 invalid common user or role name?
Connect to the pluggable database instead of the root (for example the FREEPDB1 service on Oracle Database Free, or ALTER SESSION SET CONTAINER) and run CREATE USER again. Only if you need a common user, give it the C## prefix.
Should I use alter session set "_ORACLE_SCRIPT"=true?
No. _ORACLE_SCRIPT is not documented in Oracle's references, so it is not a supported way to create users, and it hides the real problem: you are in the wrong container. Create a local user in the PDB instead.
What is the difference between a common user and a local user?
A common user is created in the root and has the same identity in the root and every PDB; its name must start with C##. A local user is created in one PDB and exists only there; its name must not start with C##.
Learn more on CodeWithSQL
Official documentation
- ORA-65096 (Oracle Database Error Messages)
- COMMON_USER_PREFIX (Oracle Database Reference 19c)
- CREATE USER (Oracle SQL Language Reference 19c)
- Overview of Managing a Multitenant Environment (Oracle Multitenant Administrator's Guide 19c)
Last technically reviewed 24 October 2026; examples and diagnostics run on Oracle Database Error Messages reference (26ai, 21c and 19c); not run locally. Messages and explanations follow Oracle's Database Error Messages reference; no Oracle Database was available, so the examples were not run locally.